PHP2Shell fixes shipped, but version checks misreport exposure
10/23/2026 — 10/24, 07:21·3 sources (all)·3 reports (all)·In the 2026-10-24 briefing
Key takeaways
- PHP has shipped fixes for PHP2Shell, covering CVE-2026-109618 and CVE-2026-109619 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, after earlier gu…
PHP has shipped fixes for PHP2Shell, covering CVE-2026-109618 and CVE-2026-109619 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, after earlier guidance on mitigating RCE while patches were pending. DEV Community · AI reports that tools checking only upstream version numbers can mislabel patched distro builds as vulnerable or miss real exposure. The author says Debian, Alpine and RHEL handle version strings differently.
Latest turnAfter PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, scanners and AI agents that only compare upstream version numbers can flag patched distributions as vulnerable or miss real exposures. The author explains why Debian, Alpine, RHEL modules, and RHEL 10 behave differently.
- Heat index
- 257
- All sources
- 3
- All reports
- 3
- First seen
- 11 hours ago
Reports on this story headlines open the original
After PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, scanners and AI agents that only compare upstream version numbers can flag patched distributions as vulnerable or miss real exposures. The author explains why Debian, Alpine, RHEL modules, and RHEL 10 behave differently.
DEV Community · AIAI score 62Two long-hidden high-severity PHP flaws, found by AI-assisted scanning, show the risk lives in the interpreter runtime, not language semantics. The author questions the language 'impossible triangle', arguing safety depends on runtime implementation and engineering investment, with C#'s managed model compressing risk onto the smaller CLR surface.
博客园AI score 59
The PHP Project has published mitigation guidance for PHP2Shell, an unpatched vulnerability that allows remote code execution. It tells users to apply the listed steps now in limited settings until a fix arrives, giving defenders an immediate hardening path.
ZDNet · AIAI score 65
Other stories people are talking about
- Heat index 1132SurgeMoonshot AI releases Kimi K3.1 Pro; open-weight release set for Nov. 413 sources
- Heat index 779SurgeOpenAI trains frontier models in offline cached-web environments9 sources
- Heat index 511Meta creates non-voting Class C shares to fund AI buildout12 sources
- Heat index 430DeepSeek closes around CNY 10B funding round led by CATL and Tencent7 sources
- Heat index 375MiniMax M3.1 Flash comes to Tenstorrent Cloud with open weights6 sources
How is heat calculated?About the methodHide
Heat counts how many independent sources covered a story in the last 48 hours: one source counts once no matter how many posts it published, decaying with a 24-hour half-life. What ranks first is what many people are talking about.
This page aggregates public feeds. Headlines and summaries are machine-organized and remain the property of the original authors; verify important facts at the source. If you believe a headline or summary infringes your rights, email the contact address in the footer with the page URL and basis of your claim, and we will remove or replace it after review.
- Surge
- Discussion rising fast
- New
- First report within 6 hours
- Rising
- Still gathering discussion